Index: /trunk/src/VBox/Main/MachineImpl.cpp
===================================================================
--- /trunk/src/VBox/Main/MachineImpl.cpp	(revision 23913)
+++ /trunk/src/VBox/Main/MachineImpl.cpp	(revision 23914)
@@ -309,7 +309,7 @@
         while (thatIt != thatAtts.end())
         {
-            if ((*it)->controller() == (*thatIt)->controller() &&
-                (*it)->port() == (*thatIt)->port() &&
-                (*it)->device() == (*thatIt)->device() &&
+            if ((*it)->matches((*thatIt)->controllerName(),
+                               (*thatIt)->port(),
+                               (*thatIt)->device()) &&
                 (*it)->passthrough() == (*thatIt)->passthrough() &&
                 (*it)->medium().equalsTo ((*thatIt)->medium()))
@@ -2433,5 +2433,5 @@
     ComObjPtr<MediumAttachment> attachment;
     attachment.createObject();
-    rc = attachment->init(this, medium, ctl, aControllerPort, aDevice, aType, indirect);
+    rc = attachment->init(this, medium, aControllerName, aControllerPort, aDevice, aType, indirect);
     CheckComRCReturnRC(rc);
 
@@ -3558,5 +3558,5 @@
          ++it)
     {
-        if (Bstr((*it)->controller()->name()) == aName)
+        if (Bstr((*it)->controllerName()) == aName)
             return setError(VBOX_E_OBJECT_IN_USE,
                             tr("Storage controller named '%ls' has still devices attached"),
@@ -5608,5 +5608,5 @@
         rc = pAttachment->init(this,
                                medium,
-                               aStorageController,
+                               aStorageController->name(),
                                dev.lPort,
                                dev.lDevice,
@@ -5751,5 +5751,5 @@
          ++it)
     {
-        if (Bstr((*it)->controller()->name()) == aName)
+        if (Bstr((*it)->controllerName()) == aName)
             atts.push_back(*it);
     }
@@ -6642,5 +6642,5 @@
             rc = attachment->init(this,
                                   diff,
-                                  pAtt->controller(),
+                                  pAtt->controllerName(),
                                   pAtt->port(),
                                   pAtt->device(),
Index: /trunk/src/VBox/Main/MediumAttachmentImpl.cpp
===================================================================
--- /trunk/src/VBox/Main/MediumAttachmentImpl.cpp	(revision 23913)
+++ /trunk/src/VBox/Main/MediumAttachmentImpl.cpp	(revision 23914)
@@ -58,5 +58,5 @@
 HRESULT MediumAttachment::init(Machine *aParent,
                                Medium *aMedium,
-                               StorageController *aController,
+                               const Bstr &aControllerName,
                                LONG aPort,
                                LONG aDevice,
@@ -65,5 +65,5 @@
 {
     LogFlowThisFuncEnter();
-    LogFlowThisFunc(("aParent=%p aMedium=%p aController=%ls aPort=%d aDevice=%d aType=%d aImplicit=%d\n", aParent, aMedium, aController, aPort, aDevice, aType, aImplicit));
+    LogFlowThisFunc(("aParent=%p aMedium=%p aControllerName=%ls aPort=%d aDevice=%d aType=%d aImplicit=%d\n", aParent, aMedium, aControllerName.raw(), aPort, aDevice, aType, aImplicit));
 
     if (aType == DeviceType_HardDisk)
@@ -78,5 +78,5 @@
     m.allocate();
     m->medium = aMedium;
-    unconst(m->controller) = aController;
+    unconst(m->controllerName) = aControllerName;
     unconst(m->port)   = aPort;
     unconst(m->device) = aDevice;
@@ -190,8 +190,11 @@
 
     /* m->controller is constant during life time, no need to lock */
-    m->controller.queryInterfaceTo(aController);
-
-    LogFlowThisFuncLeave();
-    return S_OK;
+    /** @todo ugly hack, MediumAttachment should have a direct reference
+     * to the storage controller, but can't have that right now due to
+     * how objects are created for settings rollback support. */
+    HRESULT rc = mParent->GetStorageControllerByName(m->controllerName, aController);
+
+    LogFlowThisFuncLeave();
+    return rc;
 }
 
Index: /trunk/src/VBox/Main/include/MediumAttachmentImpl.h
===================================================================
--- /trunk/src/VBox/Main/include/MediumAttachmentImpl.h	(revision 23913)
+++ /trunk/src/VBox/Main/include/MediumAttachmentImpl.h	(revision 23914)
@@ -54,5 +54,5 @@
     HRESULT init(Machine *aParent,
                  Medium *aMedium,
-                 StorageController *aController,
+                 const Bstr &aControllerName,
                  LONG aPort,
                  LONG aDevice,
@@ -83,5 +83,5 @@
 
     const ComObjPtr<Medium> &medium() const { return m->medium; }
-    const ComObjPtr<StorageController> &controller() const { return m->controller; }
+    Bstr controllerName() const { return m->controllerName; }
     LONG port() const { return m->port; }
     LONG device() const { return m->device; }
@@ -89,7 +89,7 @@
     bool passthrough() const { AutoReadLock lock(this); return m->passthrough; }
 
-    bool matches(CBSTR aController, LONG aPort, LONG aDevice)
+    bool matches(CBSTR aControllerName, LONG aPort, LONG aDevice)
     {
-        return (    aController == m->controller->name()
+        return (    aControllerName == m->controllerName
                  && aPort == m->port
                  && aDevice == m->device);
@@ -125,5 +125,10 @@
 
         ComObjPtr<Medium> medium;
-        ComObjPtr<StorageController> controller;
+        /* Since MediumAttachment is not a first class citizen when it
+         * comes to managing settings, having a reference to the storage
+         * controller will not work - when settings are changed it will point
+         * to the old, uninitialized instance. Changing this requires
+         * substantial changes to MediumImpl.cpp. */
+        Bstr controllerName;
         const LONG port;
         const LONG device;